CVE-2026-98711

What it actually does

Out-of-bounds read during TX frame padding in cw1200 driver allows up to 511 bytes of kernel heap memory to be copied into bus transfers sent to the WiFi device.

Why it matters to the business

Kernel memory contents containing sensitive data can be exfiltrated to a malicious or compromised wireless device, increasing risk of information leakage in environments using affected Linux kernels with cw1200 hardware.

How an attack unfolds

An attacker positions a rogue device on the bus (SDIO/SPI). When the driver transmits frames, the padding logic reads beyond allocated skb tailroom, causing stale heap bytes to be transmitted; the device captures these bytes. No authentication or special privileges are required beyond the ability to observe bus traffic.

How to fix it

Update the Linux kernel to a version containing the fix that reserves tailroom via alloc_len, computes exact padding with align_size(), and explicitly zeros padding bytes before transfer. Reboot systems after applying the update. Where immediate patching is impossible, restrict use of cw1200 hardware or isolate affected systems from untrusted bus devices.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds tailroom reservation and zeroing of padding bytes. Monitor for absence of OOB reads by inspecting skb tailroom calculations in cw1200_data_write(). Test with memory-poisoning tools to verify no stale data appears in transfers.

Typical attack path

1. Attacker deploys or compromises a device attached via SDIO or SPI that accepts cw1200 bus transfers.
2. Victim system performs normal WiFi TX operations using the cw1200 driver.
3. Driver computes padded length but fails to reserve or zero tailroom, reading past valid frame data.
4. Padded bytes containing kernel heap contents are transferred over the bus.
5. Rogue device records the leaked bytes for offline analysis.

How to detect it

Review kernel logs for cw1200 TX path anomalies or memory allocation warnings. Inspect bus traces or device firmware logs for unexpected data patterns following frame transmissions. Correlate with high-volume TX activity on affected hardware.

What your security team should do

• Prioritize kernel updates on all systems exposing cw1200 wireless interfaces within the next patch cycle.
• Inventory hosts using cw1200 drivers and assess exposure to untrusted bus devices.
• Apply compensating controls such as hardware isolation or driver blacklisting where updates cannot be deployed promptly.